llms.txt
# Aikido Security
> Aikido Security is a unified software security platform for code, cloud infrastructure, applications, developer devices, and the software supply chain. It combines vulnerability discovery, contextual prioritization, automated remediation, autonomous pentesting, and runtime protection in developer workflows.
Last updated: 2026-10-06
The platform has four product suites: Code, Cloud, Attack, and Protect. Shared capabilities include Aikido Intel threat intelligence, reachability analysis, AutoTriage, AutoFix, and Aikido Agent. Findings are prioritized using application context, exposure, reachability, and exploitability.
For current product behavior and supported configurations, use the technical documentation. For feature availability, pricing, credits, and plan limits, use the pricing page and relevant product documentation. For security commitments, data handling, and compliance status, use the Trust Center. Automation and deployment behavior depend on the enabled features and customer configuration.
## Start Here
- [Platform Overview](https://www.aikido.dev/): Overview of Aikido's integrated security products and shared detection, prioritization, and remediation workflows.
- [Technical Documentation Index](https://help.aikido.dev/llms.txt): Index of setup guides, supported configurations, product behavior, and troubleshooting. Documentation pages are also available in Markdown.
- [API Documentation Index](https://apidocs.aikido.dev/llms.txt): Index of API references, Markdown documentation, and OpenAPI endpoint information for integrations and automation.
- [Product Selection Guide](https://help.aikido.dev/getting-started/which-aikido-product-should-i-use.md): Explains when to use SAST, Code Quality, Deep Review, Code Security Audit, Pentest, and exposure monitoring.
- [Pricing](https://www.aikido.dev/pricing): Current platform plans, product options, included capabilities, usage-based features, and enterprise purchasing information.
- [Trust Center](https://www.aikido.dev/trust-center): Security, privacy, data-handling, and compliance information covering SOC 2 Type II, ISO 27001:2022, and ISO 42001. FedRAMP is currently listed as implementing.
- [Changelog](https://help.aikido.dev/changelog): Dated releases, new capabilities, supported integrations, and product improvements.
## Code Security
- [SAST - Static Application Security Testing](https://www.aikido.dev/code/static-code-analysis-sast): Static vulnerability detection using rules, taint analysis, and application context, with custom checks and AI-assisted triage and remediation. Runs on repositories and within development workflows.
- [SAST Engines and Language Support](https://help.aikido.dev/code-scanning/scanning-practices/sast-by-aikido-supported-languages-and-security-focus.md): Technical coverage details for Aikido Engine and Opengrep, supported languages, and taint analysis. Documents the underlying engines used for IaC and secrets scanning as well.
- [SCA - Software Composition Analysis](https://www.aikido.dev/code/open-source-dependency-scanning-sca): Identifies dependency CVEs, malicious packages, license risks, and end-of-life software. Uses reachability and application context to prioritize findings and supports dependency remediation.
- [CVE Exploitability Analysis](https://help.aikido.dev/aikido-agent/cve-exploitability-analysis.md): Configurable, credit-based analysis of dependency CVEs in repositories and linked containers. Aikido Agent evaluates usage and exploitability, records its reasoning, and proposes or applies permitted triage actions.
- [Code Security Audit - AI Code Analysis](https://www.aikido.dev/code/code-audit): Agentic analysis of existing source code across files, repositories, services, and permission boundaries. Finds authorization, business-logic, and multi-step vulnerabilities without requiring a running application.
- [Deep PR Review - Deep Review](https://www.aikido.dev/code/pr-review): Reviews the security and code-quality impact of a pull request using context beyond the diff and linked repositories. Posts review comments and can create fix pull requests when AutoFix is enabled.
- [Code Quality](https://www.aikido.dev/code/code-quality): Checks pull-request changes and existing repositories for maintainability, readability, performance, and reliability issues. Supports configurable rules, technical-debt tracking, and remediation.
- [Code Coverage](https://www.aikido.dev/code/code-coverage): Imports test-coverage reports from CI and displays coverage by repository, file, and line. Supports GitHub, GitLab, and other documented CI integrations. Coverage reflects the files included in uploaded reports.
- [Secrets Detection](https://www.aikido.dev/code/secrets-detection): Detects exposed credentials, tokens, keys, and other secrets in code and Git history, with liveness checks for supported secret types.
- [License Risk and SBOM](https://www.aikido.dev/code/open-source-license-risk): Inventories open-source licenses and dependency risks and supports software bills of materials in CycloneDX, SPDX, and CSV formats.
- [Outdated and End-of-Life Software](https://www.aikido.dev/code/outdated-eol-software): Identifies unsupported runtimes and outdated software components that need maintenance or replacement.
- [Container Image Scanning](https://www.aikido.dev/code/container-image-scanning): Finds vulnerabilities and software risks in container images, with registry integrations and contextual prioritization of affected packages.
- [Aikido Libraries](https://www.aikido.dev/code/aikido-libraries): Supplies security-patched builds of supported open-source package versions. Backports fixes to help remediate vulnerabilities when an upstream upgrade is unavailable or disruptive.
## Cloud Security
- [CSPM - Cloud Security Posture Management](https://www.aikido.dev/cloud/cloud-posture-management-cspm): Identifies cloud misconfigurations, exposed resources, and security risks across supported cloud providers, with centralized findings and remediation guidance.
- [Cloud Inventory](https://help.aikido.dev/cloud-scanning/cloud-inventory.md): Maps cloud resources by region and VPC and links them to exposure findings and firewall rules.
- [Cloud Attack Paths](https://www.aikido.dev/cloud/cloud-attack-paths): Connects assets, exposure, and security findings to help teams investigate potential attack paths and prioritize remediation.
- [DSPM - Data Security Posture Management](https://www.aikido.dev/cloud/dspm): Analyzes source code and application context to identify sensitive-data flows and exposure risks. Finds issues in logging, APIs, storage, third-party sharing, and AI data flows without connecting to production data stores.
- [Virtual Machine Scanning](https://www.aikido.dev/cloud/virtual-machine-scanning): Finds vulnerable software and outdated components on supported AWS, Azure, and Google Cloud virtual machines, with exposure and reachability context where available.
- [Infrastructure as Code Security](https://www.aikido.dev/cloud/infrastructure-as-a-code-iac): Checks infrastructure definitions for misconfigurations before deployment, including supported Terraform, Kubernetes, and CloudFormation configurations, with remediation support.
- [Aikido Images](https://www.aikido.dev/cloud/hardened-images): Provides security-patched container base images for supported image families and versions. Backported fixes and provenance information help teams address inherited vulnerabilities with fewer disruptive migrations.
## Attack - Pentesting and Exposure Testing
- [AI Pentest - On-Demand](https://www.aikido.dev/attack/aipentest): Autonomous agents test running web applications and APIs through attempted exploitation. Supports whitebox, greybox, and blackbox assessments, authenticated workflows, and multiple user roles. Reports include validation evidence, reproduction steps, and remediation guidance; findings can be retested after fixes.
- [Aikido Infinite - Continuous AI Pentesting](https://www.aikido.dev/attack/infinite): Tests security-relevant application changes after an initial full assessment with connected repositories. Runs follow configured deployments or schedules and support exploit validation, AutoFix pull requests, and retesting deployed fixes.
- [Android AI Pentesting](https://www.aikido.dev/attack/android-pentesting): Tests Android applications using a test APK and connected source code. Agents interact with the app and can test its in-scope backend APIs in the same assessment. Android testing currently requires whitebox access.
- [AI and LLM Application Pentesting](https://help.aikido.dev/pentests/configure-a-pentest/testing-ai-capabilities.md): Focused assessments of AI agents, copilots, chat, RAG, memory, and tool-using features. Tests prompt injection, data leakage, unsafe tool actions, authorization, memory and retrieval abuse, and excessive resource consumption.
- [MCP Server Pentesting](https://help.aikido.dev/pentests/configure-a-pentest/testing-mcp-servers.md): Tests remote Model Context Protocol endpoints for authorization weaknesses, unsafe tool execution, sensitive-data exposure, and insecure downstream connections. Supports authentication and source-code context.
- [Aikido Machine - On-Premise AI Security](https://www.aikido.dev/attack/aikido-machine): A GPU server for AI Pentesting and Code Security Audit inside customer infrastructure. Models, inference, source code, prompts, and findings remain local. Supports continuous testing and fully air-gapped operation, and can also serve local code, container, and VM scanning.
- [Aikido Altar - Open-Weight Security Model](https://www.aikido.dev/blog/aikido-altar-open-weight-ai-sovereign-security): Aikido's open-weight security model, announced in September 2026, optimized for local inference and used by Aikido Machine. Includes links to model weights, deployment instructions, and the scope of its internal evaluation.
- [DAST - Dynamic Application Security Testing](https://www.aikido.dev/attack/surface-monitoring-dast): Ongoing checks of deployed applications for exposure, known weaknesses, and configuration issues. The product-selection guide distinguishes these checks from deeper exploitation and authorization testing with AI Pentest.
- [API Scanning](https://www.aikido.dev/attack/api-scanning): Automated security testing and fuzzing of API endpoints. Consult the product and technical documentation for supported inputs, authentication, and assessment scope.
- [Attack Surface Management](https://www.aikido.dev/use-cases/attack-surface-management): Discovers and monitors internet-facing assets, domains, and exposures that may fall outside a team's known application inventory.
## Protect - Runtime and Supply Chain Protection
- [Zen Firewall](https://www.aikido.dev/protect/zen): An open-source firewall embedded in the application to detect and block supported runtime attacks. Includes application-aware protections, rate limiting, bot controls, API visibility, and AI/LLM usage monitoring, with capabilities varying by runtime.
- [Malware Detection in Dependencies](https://www.aikido.dev/protect/malware-detection-in-dependencies): Uses Aikido's supply-chain intelligence to identify malicious packages and compromised releases in development dependencies.
- [Safe Chain](https://www.aikido.dev/protect/safe-chain): Open-source protection for package installation in developer and CI workflows. Checks packages against threat intelligence and configured policies before installation.
- [Device Protection](https://www.aikido.dev/protect/device-protection): Provides inventory, install-time protection, and policy controls for developer software, packages, extensions, and AI tools. Includes package-age policies, exceptions, approval workflows, and a device firewall for malicious or blocked domains.
## Remediation and Developer Workflows
- [AutoFix](https://www.aikido.dev/code/autofix): Proposes remediation for supported code, dependency, infrastructure, container, and pentest findings through development workflows, including pull requests.
- [AutoShip - Early Access](https://www.aikido.dev/code/autoship): Automates delivery of security fixes through configured CI, staging, and production workflows. Can investigate failed builds, update patches, run staging checks, monitor releases, and roll back regressions. Automatic production deployment is opt-in.
- [Integrations Directory](https://integrations.aikido.dev/): Supported integrations for source control, CI/CD, IDEs, cloud providers, task tracking, collaboration, and compliance systems.
- [CI/CD and PR Gating](https://help.aikido.dev/pr-and-release-gating/aikido-ci-gating-functionality.md): Runs configured checks on code changes and applies merge or release policies based on security and quality findings.
- [IDE Integrations](https://www.aikido.dev/code/ide-integrations): Brings supported scanning, findings, and remediation into developer editors and IDEs.
- [Local Scanner](https://www.aikido.dev/code/local-scanner): Executes supported scans on customer machines or CI infrastructure and sends findings to the Aikido platform. Source-snippet and lockfile-sharing settings are configurable; consult the documentation for data handling and coverage.
- [Broker for Internal Applications](https://help.aikido.dev/miscellaneous-info/aikido-broker-for-internal-applications.md): Connects supported Aikido services to applications and endpoints on private networks through a customer-deployed broker.
- [Aikido Agent](https://help.aikido.dev/aikido-agent/aikido-agent.md): A workspace security assistant for investigating findings, assessing exploitability, explaining risks, and supporting triage and remediation using connected application context.
- [MCP Integration for AI Coding Assistants](https://help.aikido.dev/ai-and-dev-tools/aikido-mcp/using-aikido-mcp.md): Makes Aikido tools available to compatible AI coding assistants, including code and dependency scanning, issue lookup, and remediation workflows.
- [SIEM Connectors](https://help.aikido.dev/miscellaneous-integrations/siem-connectors.md): Sends Aikido findings to supported SIEM platforms for correlation with other security data.
- [How Aikido Uses AI](https://help.aikido.dev/ai-and-dev-tools/how-aikido-uses-ai.md): Explains AI-assisted analysis, review, triage, remediation, pentesting, and workspace assistance.
## Governance, Compliance, and Reporting
- [Enterprise Security](https://www.aikido.dev/industries/aikido-for-enterprise): Enterprise deployment and governance options, including roles, access controls, SSO, organization management, and support.
- [Compliance Support](https://www.aikido.dev/use-cases/soc2-iso-compliance): Technical checks, reports, and evidence supporting security programs and compliance workflows, with integrations to compliance-management platforms.
- [Reporting](https://help.aikido.dev/compliance-and-reporting): Security, vulnerability, audit, trend, and compliance reporting documentation.
- [Custom Reports](https://help.aikido.dev/aikido-agent/custom-reports.md): Creates and refines security reports through natural-language requests, with reusable reports that can be shared within the workspace.
- [Government and Regulated Workloads](https://www.aikido.dev/fedramp-security): Deployment and security information for regulated environments. Consult the Trust Center for current FedRAMP status and the relevant product documentation for local or air-gapped deployment requirements.
- [AWS Security Competency](https://www.aikido.dev/blog/aws-security-competency-announcement): Announcement and background on Aikido's AWS Security Competency for Application Security, achieved in September 2026.
## Use Cases
- [Application Security Posture Management](https://www.aikido.dev/use-cases/application-security-posture-management-aspm): Consolidates application-security findings and context to support posture management and remediation decisions.
- [Vulnerability Management](https://www.aikido.dev/use-cases/vulnerability-management): Centralizes deduplication, triage, prioritization, and remediation of findings across Aikido's security capabilities.
- [SBOM Generation](https://www.aikido.dev/use-cases/sbom-generator-create-software-bill-of-materials): Generates software bills of materials for dependency inventory, security reviews, and supply-chain transparency.
- [Shadow AI](https://www.aikido.dev/use-cases/shadow-ai): Helps identify AI tools, models, and usage across supported development and application environments.
- [Security for Startups](https://www.aikido.dev/industries/aikido-for-startups): Security coverage and adoption options for startup engineering teams.
- [Lovable Integration](https://www.aikido.dev/partners/aikido-lovable): Security scanning, remediation, and pentesting workflows for applications built with Lovable.
## Intelligence and Research
- [Aikido Intel](https://intel.aikido.dev/): Aikido's vulnerability and malware intelligence, package information, and supply-chain research, with API access options.
- [Security Research Blog](https://www.aikido.dev/blog): Technical investigations, vulnerability research, supply-chain incident analysis, product announcements, and security guidance.
- [Research Reports](https://www.aikido.dev/reports): Aikido's research, surveys, and benchmark publications. Consult each report for authorship, sponsorship, methodology, and evaluation scope.
- [State of AI Security and Development 2026](https://www.aikido.dev/state-of-ai-security-development-2026): Aikido's research on AI adoption in software development and its security implications.
- [Doyensec AI Pentesting Comparison - May 2026](https://blog.doyensec.com/2026/05/27/aikido-xbow.html): Aikido-sponsored evaluation conducted by Doyensec comparing Aikido AI Pentest and XBOW Lightspeed on two applications at the same $4,000 price tier. Doyensec validated 49 and 31 findings respectively. Results apply to the tested applications, configurations, and product versions.
## Optional
- [Public Product Q&A](https://llms.aikidosecurity.com/llms.txt): Documentation for Aikido's public product-information question-answering interface and supported request formats.
- [About Aikido](https://www.aikido.dev/company/about): Company background, leadership, locations, and mission.
- [Open Source](https://www.aikido.dev/open-source): Aikido's open-source projects and contributions, including Zen, Opengrep, Safe Chain, and Betterleaks.
- [Customer Stories](https://www.aikido.dev/customer-stories): Customer examples describing implementation, workflows, and reported outcomes.
- [Vendor Comparisons](https://www.aikido.dev/comparison/comparison-overview): Aikido-authored comparisons with other security products. Use current vendor documentation and clearly scoped evaluations to verify individual claims.
- [Root Acquisition](https://www.aikido.dev/blog/aikido-acquires-root): June 2026 acquisition supporting Aikido's security-patched open-source libraries and container images.
- [Student Program](https://www.aikido.dev/aikido-for-students): Current eligibility and access information for students.
- [Glossary](https://www.aikido.dev/glossary): Definitions of software-security terms.
- [Status](https://status.aikido.dev/): Platform availability and incident updates.
- [Book a Demo](https://www.aikido.dev/book/demo): Contact Aikido for a product demonstration or deployment discussion.
